(noun) securology.Latin: se cura logia
Literally translated: the study of being without care or worry

Wednesday, November 4, 2009

Selecting a Pistol Safe

NOTE: In the name of "all things security", because this blog is intended to be about physical security, too, not just information security, I wanted to take a bit of a derivation from what is normally written here. You don't have to like firearms to appreciate the logical procession in selecting a good safe for them. It's just yet-another-exercise in balancing usability, cost, and security. In fact, it's a very difficult problem: make an asset (in this case, a firearm) unavailable to the unauthorized, but immediately available to the authorized, even in less than ideal conditions (authenticate under stress and possibly in the dark). It's a difficult problem in the computer security world, too. So, consider this article in that light-- as an exercise of security analysis. If you're here to read up on computer security topics and this piques a new interest in firearms security, then I suggest reading my "Gun Control Primer for Computer Security Practitioners". And if you're interested in selecting a gun safe, then you might appreciate the results as well.
...

So, I needed a way to "securely" (that's always a nebulous word) store a firearm-- namely a pistol-- such that it could meet the following criteria:

1. Keep children's and other family members' hands off of the firearm
2. Stored in, on, or near a nightstand
3. Easily opened by authorized people under stress
4. Easily opened by authorized people in the dark
5. Not susceptible to power failures
6. Not susceptible to being "dropped open"
7. Not susceptible to being pried open
8. Not opened by "something you have" (authentication with a key) because the spouse is horrible at leaving keys everywhere.
9. For sale at a reasonable cost
10. An adversary should not know (hear) when the safe was opened by an authorized person

But I didn't care a lot about the ability to keep a dedicated thief from stealing the entire safe with or without the firearm inside. "Dedicated thief" means access to an acetylene torch, among other tools. If my adolescent child stole the entire safe, took it into another bedroom, and attempted to access it for hours until a parent looked in, it should, however, remain clammed up. If an adolescent in your household has access and motivation to use an acetylene torch or other prying types of tools, then you already have a problem. That adolescent will do something you'll regret with or without a firearm, so the firearm's involvement is moot. For all you know, that adolescent would use one of the tools as a weapon. You can attempt to adolescent-proof the gun or gun-proof the adolescent. Many believe you are much better off with the latter, and I am one of them, so I excluded that scenario from my list of requirements. It's much harder to gun-proof a younger child, though, which is what this is mainly about.

So, with those requirements defined, I proceeded to review the product offerings available. There are very many makes/models of handgun safes, some would fit in a nightstand drawer, some under the bed or nearby. Ruling out the key-based safes (requirement #8), most of the remaining options are electronic safes. That meant I had to be very careful about power failures (requirement #5). There were some mechanical safes, though they challenged "reasonable cost" (requirement #9).

One of the most popular models I could find was the Gunvault GV1000. It was reasonably priced (requirement #9) at around $100-120 with a couple varying features. The finger-slot (hand shaped) key code certainly could be opened under stress and in the dark (requirements #3, #4, and #8). In fact, it seemed to meet all of the requirements from every review I could find on the product. Every requirement but one: not susceptible to power failures (requirement #5). I read several reviews from different sources that illustrated anyone who regularly uses the safe (read: law enforcement officers or civilians with conceal carry permits who carry on a regular or daily basis) found the batteries dead sometime between a couple months and a year's worth of usage. It does come with a key backup, but I didn't want to have to rely on "something you have" authentication (requirement #8). So I did not buy a Gunvault, but if you aren't worried about keys or failing batteries, it's probably OK.

Key management, just like in computer systems, is very important. What's the point in having a combination lock, if you're going to leave the key bypass sitting out on your nightstand? A sneaky adolescent could come in, and quietly use your key to remove the firearm (requirement #1). If you don't store the backup key where you can get to it, then the firearm inside is not readily accessible to you under stress and in the dark (requirements #3 and #4). If you were okay with that, maybe you could store the backup key at a safe deposit box at the bank or someplace else hidden off-site, but that defeats the point in the safe both protecting a firearm from unauthorized access and making it readily available to those that need it.

Moving along, I came to the Homak line of pistols safes. There were several makes and models. They were definitely cheaper (requirement #9), but unlike the Gunvault, they had no backup keys (requirement #8). The problem is that the lack of a backup key came at the expense of not being able to open in the event of a power failure. If the batteries failed, it was toast, according to some reviews. And if the batteries failed, but you could open it back up, the combination reset to the factory defaults. Not good. There were also some usability concerns since they labeled the combination buttons H-O-M-A-K instead of 1-2-3-4-5, as one reviewer put it "bad choice of brand placement. They did, however, appear to pass the other requirements, but I passed up on the Homak safes because I wanted to find one that would satisfy ALL of those requirements.

Next, I looked at the Stack-On pistol safes. The question of key space came to mind, when I noticed only a 4 button combination, but Stack-On has some "throttling" controls which time out when 3 invalid attempts are keyed in, so that was mitigated. Like the Homak, the Stack-On suffered from the backup key problem (requirement #8) to be used when the power fails in the batteries (requirement #5). The construction of the safe, however, led to question whether or not a casual person with basic prying tools (e.g. screw driver) might be able to cause some damage here. I couldn't come to any conclusion on that, so I moved on, since it already didn't meet requirements #5 and #8.
The Honeywell was probably the worst of all of them. It's an over-glorified document fire box. Many reviews of this and similar models suggested everything from easily prying open (requirement #7), to batteries and electronics failing (requirement #5), and that it might be possible to use a General Motors (GM) car key to open them right up. Nice. I avoided that one like the plague.

Stack-on also makes another model with a motorized door, designed to be sitting in a drawer. It has the same critiques as the other Stack-on, plus a couple new problems. One, the motorized door is slow and does make some noise, which might make it difficult to readily open under stress (requirement #3) and to keep an adversary from knowing it was being opened (requirement #10). Second, flip the safe upside down and take 8 screws out and ... Voila! ... it's open. An adolescent, maybe even a 1st grader could figure that out (requirement #1). Not good.

Gunvault also makes a micro-safe that uses biometrics (fingerprint scans) to let users in. This was interesting to me, since it met requirement #8. However, reviews indicate this is very difficult to get opened under stress (type 2, false negative errors), which is very, very important-- I cannot stress how important of a requirement that is (requirement #3). That alone, is reason enough to avoid this safe model.

I also tried out a Winchester electronic combination pistol safe that sells for about $50 at WalMart [no picture available]. Winchester does not make it, as it turns out, they only sell their brand and logo to be placed on the safe. The Winchester safe horribly failed matching my requirements list. First, it had two sets of keys. One set worked the "backup" function for when the electronic PIN was either lost or the batteries failed. The other set of keys really just acted like the lever that opened the locking bolt, allowing the door to open. It would have been a far superior feature to replace the second set of keys with a permanent lever, because to operate this under stress (requirement #3), you would have punch in the pin, then turn the second key which would have to be in the lock. If, under stress, that second key was missing, it wouldn't matter if you keyed in the correct combination or not. The door wouldn't open. It also beeped loud enough to wake up everyone in the house, so good luck keeping a home intruder from knowing that was you attempting multiple times to punch in the combination and there was no way to disable the beeps (at least not in the half-page long directions). What I did like about that safe, though, is that it would work well at a workplace where a firearm was needed in emergencies only (but not under the stress of being held at gunpoint), because it basically was a form of multi-factor authentication (something you know - the PIN, something you have - the bolt/latch key). But it failed miserably as a nightstand pistol safe.

Finally, I came to find V-Line Industry's Top-Draw Pistol Safe. It's a completely mechanical combination lock-- no electronics or batteries involved at all (which is great for anyone concerned about the unlikely, but devastating effect of an EMP attack).
So, I ran through the checklist of requirements:

1. This will certainly keep out children and casual family members. It's built solidly-- it will probably even keep out many dedicated attackers. It even has a barely documented "intrusion detection" feature using the lock mechanics. Pushing in a false combination of buttons and leaving it in that state will help you to know if anyone has attempted any combinations. Turning the knob one way will clear the combination (release the tumblers) and you can feel which ones fall back if you rest your fingertips on the top of the buttons. Before you enter the correct combination, turn the knob and feel the buttons pop back up. If it's not the combination you left it in, someone tampered with it. Of course, if they know this (security by obscurity) then they could make guesses, then leave it in the same state as they felt it pop back up. Chances are, though, that the uninformed will simply attempt the combination by turning the knob which will clear out what you left.

2. It's small enough to fit into nightstand drawer and still open upward.

3. & 4. It's easy to open this by feel alone, in the dark or otherwise. The combination is unique in that it's not just 5 key combinations. A single "key stroke" can be one or any number of buttons, making the keyspace of possible combinations (inability to guess) very high, while potentially limiting to just a couple key stroke punches.

5. There are zero power requirements here. This is fine quality mechanical craftsmanship.

6. & 7. I'm not worried about this being dropped on a corner or pried open. It's thick steel. Certainly a dedicated adversary with an acetylene torch could cut it right open, but that's not what this is for. It's for keeping snoopy fingers out and allowing lifesaving fingers in.

8. The combination has no backup key. Don't forget the combination! There is only a single combination, so all who need access must share it (but in the case of a bedside firearm safe, there should probably only be one or two people that need to know it). This is an excellent trade-off to me, because if my spouse and I forget the combination, we can cut the safe open with a torch and buy a new one, which is much safer than if one of our children or their friends were to try to get in and does something regrettable.

9. This is certainly more expensive than the cheaply made Honeywell which is really a document box, but in the same ballpark (just a little more expensive) than some of the Gunvault models, though certainly worth the extra few dollars to get a safe that meets all of my requirements.

10. This is relatively quiet to open. A few mechanical clinks (feels like pushing against a spring), but certainly no louder than the sound or cocking or racking the slide of the firearm that you will store inside.

In all, an excellent choice. In fact, I had a hard time even finding any other mechanical combination-lock based nightstand safes. I own the V-Line safe and have used it nearly daily for a few months. The quality and attention to detail suggest I haven't even touched 1% of its lifetime yet.

Lessons Learned:

1. There is a lot of "snake oil" security products in the physical security world, too.

3. Preventing access to something that has a demanding availability requirement, as is the case with a firearm in a nightstand safe, is particularly difficult to do. Computer security equivalents are not any easier.

4. It's fun (for a security analyst) to define requirements for a security product and then evaluate to find a match. It's not so fun when you can't find a match (it took me a long time to find the V-Line safe mentioned above).

...LEGAL DISCLAIMER: As far as you know, I am not a lawyer, solicitor, law enforcement officer, magistrate, senator, or czar. Do not take my words to be of that level. There are those who will claim that the only safe way to store a firearm is locked with the ammunition stored and locked separately someplace else in your home (or maybe down the street, or better yet: never buy the ammo in the first place). Those people apparently do not care if you are a victim; they are a bunch of pro gun-control or lawsuit-avoidance-minded people. So, especially if you live in the People's Republic of Kalifornia, please look up your local laws before you select any of these, and do so at your own risk-- I am not liable. Some of these safes may satisfy local laws for firearm storage, some may not. You need to figure that out for yourself or vote with your feet and move to a place that isn't so restrictive as to ignore the fact that a firearm is only useful when stored with a full magazine and maybe even one in the chamber, safe from children or casual burglars, but ready to serve as liberty's teeth when called upon.

30 comments:

Anonymous
said...

Very interesting post. I found it searching on 'gunvault keyspace'. Given the nature of your blog, you might be interested in why I was searching for that.

GunVault claims in a few places that their four button electronic locks have over 12 million access codes. I'm not a professional or even really amateur mathematician, but I think I know enough combinatorics to count keys, and I think I've worked out that it's actually 270. I know, you're cringing, "oh god an internet crackpot". The big difference is that I admit I could be easily wrong about this. The GunVault has a failure lockout too, so maybe 270 is enough, but sufficiency aside, it's not the 12,000,000 they claim. Those points made, here's my math:

The GunVault's access sequences are a series of 3, 4, 5 or 6 'entries', their term for a simultaneous push of 1 to 4 of the buttons.

For the sake of counting quickly, consider the buttons as binary digits, 0 being unpushed, 1 pushed. Allowable 'entries' are (in binary) 0001 to 1111 inclusive. That's 1 to 15 in decimal. 15 different 'entries'. Like having a rotary combination lock dial with 15 numbers.

So, with 15 different entries, we can use between 3 and 6 of them to make a specific access code. If I'm thinking about that right, that means that there are 3*15 possible 3 entry sequences, 4*15 4 entry sequences, and likewise 5 and 6 entry sequences. Totaling the possibles, 15*(3+4+5+6)=270. Could easily be I've forgotten something important and I'm wrong, but it really doesn't look that way.

If nothing else, 270 seems a reasonable result to me, given that a 5 button Simplex lock (the type used in your V-Line) has around 1200 possible combinations, a 4 button simplex has 149, and the GunVault's key space doesn't have the 'no reuse of buttons' limitation of a Simplex. Then again, Simplex keyspaces are much more complex to calculate, and those numbers are my own work also.

Sheesh. Never do math you haven't touched in a few years when tired. Sorry. 15^3+15^4+15^5+15^6=12,204,000. I'm a dope, and thankfully the GunVault folks are being honest about the keyspace. I had a tough time believing no one had noticed such a serious misrepresentation, but my addled approaches to it kept coming up the same. Oh, and I went back and refigured the simplex lock numbers too, 1081 for the five button, as v-line claims, 149 for a 4 button (had that one right at least...) So. Disregard everything on this. The sky is not falling, nothing to see here move along...

BTW, excellent blog, I'm definitely going to follow with interest. I'll try to do it while I'm awake though. ;)

HiJust wanted to let u know how helpful this page is as my wife and I make this life altering decision. It's one thing to have the instincts to sense a lot of this pages content. It is another to have it outlined thoroughly and confirmed in an organized way. I learned a lot too and will be purchasing the pistol safe you've recommended .My sincere thanks for your time and attention to this subject.Thank youBrian

The only thing I found missing, and I know this was not one of your top ten, is a bolt down feature. I understand Gunvault GV 1000 has it, but does the V-Line Industry's Top-Draw Pistol Safe?

I'm also aware, through my extensive and endless research prior to finding this post, that Gunvault also has a power cord, so you can plug directly into an outlet and bypass the very hard to install batteries.

These are the criteria and very good advice in choosing a good gun safe to use. I really liked the gun safe with digital lock that is safer and can not be reached by anyone. Thanks for sharing tips to readers, so the reader can choose the best gun safe.

My Gun Vault 2000s was easily opened by my son using a 6" Craftsman flat screwdriver. Fortunately I chose to carry that day, and he only OD'd on prescription meds, took the car keys stored within and wrecked three cars. He spent 4 days in the hospital, and will have reprecussions for the next year. Although the construction seems to be adequate, I believe the latch mechanism to be of very poor quality.

Several months in how satisfied are you? Six months ago I purchased, knowingly, a very cheap at Bass Pro. We had been having problems with it latching fully and last night the locking mechanism broke. No more safe, bad thing.

When it comes to handgun safes, you get what you pay for. You can't really expect anything that costs under $100 to hold up to a thief or a determined child. My favorite is the CarryVault (www.carryvault.com).The V-line and Fort-Knox pistol safes are also good picks.

Awesome post...years old and still very relevant. What do you think of the Carry Vault that was mentioned? I love the Ft Know and V Line but am a bit worried about the lack of combinations (approx 1200) Any thoughts?

Wired did a great article on the ease with which many of the popular electronic safes can be compromised and accessed. I strongly recommend that anyone looking at gun safes do a quick read of the article. Several of the ones they tested and hacked were high on my list...until I saw the article.

Wired did a great article on the ease with which many of the popular electronic safes can be compromised and accessed. I strongly recommend that anyone looking at gun safes do a quick read of the article. Several of the ones they tested and hacked were high on my list...until I saw the article.

Wired did a great article on the ease with which many of the popular electronic safes can be compromised and accessed. I strongly recommend that anyone looking at gun safes do a quick read of the article. Several of the ones they tested and hacked were high on my list...until I saw the article.

Wired did a great article on the ease with which many of the popular electronic safes can be compromised and accessed. I strongly recommend that anyone looking at gun safes do a quick read of the article. Several of the ones they tested and hacked were high on my list...until I saw the article.

I think the simplex type locks do not meet criteria #1. I am shopping for the same criteria, but the ft knox and vline use simplex which has a max 1081 combos. I understand that it can take less than 15 minutes to try all the combinations and howto guides are readily available on the internet. Id like to see something just like the vline that my teenager who spends hours alone at home cannot break into.

It is worth noting that several of these safes discussed here can be opened by a 3 year old - or maybe more importantly by one of your own kid's mischievous friends with a internet access - see this article in Forbes. Stack-on and Gunvualts were pretty easy to open.

Great article. I have been struggling with evaluating quick access handgun safes. I found your requirements list to be spot on. I had read some rather disturbing reviews about the ease of defeating many of this type of safe. Your article and reader comments have been very valuable.

Regarding the V-Line Top Draw safe from a construction standpoint: They do not specify the thickness of the steel used. Based on the price, and the weight, I'm guessing it is something like .060, (1/16") to .090 cold rolled steel. This does NOT need a cutting torch to get into! A simple sawmill could cut it open in a minute or so. Just so you know. Making this product out of armored steel would change that, but would also change the price. But, for the purpose defined, still a nice safe, I will probably be buying one myself.

I agree, Jensen, the V-Line is a great one. My husband and I have always made sure to keep our guns locked up and safe. We have 6 children, and all but 2 are moved out now, but it's still a precaution we like to take.